Vast Ai
v1.0.0Provision and manage on-demand GPUs on VAST.ai, including search by GPU and price, renting containers, retrieving SSH, and checking account balance.
⭐ 1· 1.3k·3 current·3 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The repository code and SKILL.md implement a VAST.ai client (search, rent, connect, balance) which matches the skill name. However the skill registry metadata claims no required environment variables while the runtime requires a VAST API key (VAST_API_KEY). That mismatch is unexpected and incoherent with the advertised metadata.
Instruction Scope
SKILL.md instructs the agent to run a CLI at an absolute developer path (node /Users/sschepis/Development/vast-ai/dist/cli.js) which will not exist in a runtime/agent environment. The instructions otherwise are scoped to VAST actions and ask the user for an API key before write operations, which is appropriate, but the absolute path and the assumption that a built dist exists are problematic.
Install Mechanism
There is no install spec (instruction-only), but full TypeScript sources, package.json and package-lock.json are included. Running this requires npm install + build (npx tsc) to create dist/*. No external download URLs or shorteners are used; dependencies are standard npm packages (axios, limiter, minimist). The lack of an install step in the skill metadata combined with source-only content is a usability/security concern (you must build/install to run).
Credentials
Runtime requires a single VAST API key (VAST_API_KEY / context.API_KEY) which is proportional to the stated purpose. However the registry metadata lists no required environment variables or primary credential, and SKILL.md/CLI both require VAST_API_KEY. This omission is a significant inconsistency and could lead to accidental exposure or misconfiguration.
Persistence & Privilege
The skill does not request permanent 'always' presence, does not modify other skills or system-wide settings, and does not declare elevated privileges. Autonomous invocation is enabled (default) which is normal and not a standalone concern.
What to consider before installing
What to consider before installing/use: 1) The skill legitimately targets VAST.ai and only needs your VAST API key to operate, which is proportional. 2) The package metadata omits the required VAST_API_KEY — the SKILL.md and code do require it; treat that omission as a red flag and ask the author to correct the metadata. 3) SKILL.md references an absolute developer path (/Users/sschepis/Development/...) and assumes a built dist/cli.js exists; the repo only contains TypeScript sources. You will need to run npm install and build (npx tsc) before the CLI will work — building/installation runs third-party code, so review compiled JS before executing and consider running in an isolated environment. 4) Before providing your VAST API key, verify the network endpoints in the code (baseUrl is console.vast.ai/api/v0) and ensure there are no hidden/external endpoints; this code appears to use only axios to the VAST API. 5) Because the skill can perform write actions (rent, destroy), only supply a key with least privilege (if VAST supports restricted keys) or use an account with limited funds. 6) Ask the publisher to: (a) declare VAST_API_KEY in the skill metadata, (b) remove absolute local paths from SKILL.md and use relative or packaged dist paths, and (c) include built artifacts or an install script so the agent/runtime behaviour is reproducible. If you cannot verify these fixes, run the code in an ephemeral VM/container and avoid giving your production VAST API key.Like a lobster shell, security has layers — review code before you run it.
ai-trainingvk97167zwh3877gsjsbgyd7crjd80k23jautomationvk97167zwh3877gsjsbgyd7crjd80k23jcloudvk97167zwh3877gsjsbgyd7crjd80k23jcomputevk97167zwh3877gsjsbgyd7crjd80k23jdevopsvk97167zwh3877gsjsbgyd7crjd80k23jgpuvk97167zwh3877gsjsbgyd7crjd80k23jinfrastructurevk97167zwh3877gsjsbgyd7crjd80k23jlatestvk97167zwh3877gsjsbgyd7crjd80k23jvast-aivk97167zwh3877gsjsbgyd7crjd80k23j
License
MIT-0
Free to use, modify, and redistribute. No attribution required.